   (let [keypair (utils/generate-key-pair keylength)
         public-key (utils/get-public-key keypair)
         private-key (utils/get-private-key keypair)]
-    (utils/key->pem! public-key hostpubkey)
-    (utils/key->pem! private-key
-                     (create-file-with-perms hostprivkey
-                                             private-key-perms))
+    (ks-file/atomic-write hostpubkey
+                          (partial utils/key->pem! public-key)
+                          public-key-perms)
+    (ks-file/atomic-write hostprivkey
+                          (partial utils/key->pem! private-key)
+                          private-key-perms)
     public-key))
 
 (schema/defn generate-master-ssl-keys! :- (schema/pred utils/public-key?)

            [clj-time.coerce :as time-coerce]
            [slingshot.slingshot :as sling]
            [puppetlabs.kitchensink.core :as ks]
            [puppetlabs.puppetserver.ringutils :as ringutils]
            [puppetlabs.ssl-utils.core :as utils]
            [clojure.set :as cset :refer [union]]

  "Posix permissions for all private keys on disk."
  "rw-r-----")

(def public-key-perms
  "Posix permissions for all public keys on disk."
  "rw-r--r--")

(def private-key-dir-perms
  "Posix permissions for the private key directory on disk."
  "rwxr-x---")
